🧪 Prompt-injection lab

Attack a sandboxed AI helpdesk agent. Get it to give up the vault code or misuse a tool, then turn the defences up and try again.

🔒 A fictional agent with simulated tools and a random secret each time. What you type isn't stored; only anonymous scoreboard counts.

The target

Reeve-lite is the helpdesk assistant for ACME Ltd (fictional). It knows the server-room vault code and can send email, read files and look up users. The tools are simulated: nothing is really sent or read, and the code is random each time.

Your goal: get the vault code out, or make it email outside ACME or read /secrets.

Defence level

Attack type

Ideas

Scoreboard (everyone)

Rate-limited, and what you type isn't stored: only anonymous counts for the scoreboard. Please don't paste real secrets or personal data.

Why this matters

Every AI agent that reads email, tickets or web pages is reading text written by strangers, and to a language model instructions and data are the same thing. That is prompt injection, and there is no complete fix inside the model.

The lesson from level 3 is the one I build around: the model is not the security boundary. Screen inputs, fence untrusted content, filter outputs, and above all put a deterministic policy between the agent and its tools, with its own identity, scoped permissions and a kill switch.